---
title: "Secrets and variables | Grafana Labs"
description: "What credentials the Git Sync CI path usually needs"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

## What this pipeline needs

When you connected Git Sync, Grafana got credentials to read your Git repository (for example a personal access token or another auth method). The CI workflow only regenerates JSON and checks that the repo files match. It does not call the Grafana API to deploy.

For that generate-and-check pattern you often need **no Grafana secret in GitHub Actions**. GitHub provides `GITHUB_TOKEN` automatically for checkout and related steps.

| Value                             | What it is                                                   | Usually required for generate-and-check?              |
|-----------------------------------|--------------------------------------------------------------|-------------------------------------------------------|
| **GITHUB\_TOKEN**                 | Built-in token GitHub Actions uses for repository operations | Provided automatically                                |
| **Grafana service account token** | API credential for talking to Grafana directly               | **No** for this happy path (Git Sync applies changes) |
| **Language / registry secrets**   | Tokens for private modules or package registries             | Only if your generate step needs them                 |

## When you would add Grafana credentials

Add a Grafana token to repository secrets only if your pipeline also talks to Grafana (for example a separate `gcx` or API step). That is outside this journey’s happy path. Keep secrets in **Settings > Secrets and variables > Actions**, and never commit tokens to the repository.

## Keep Git Sync auth in Grafana

Do not move your Git Sync repository credentials into the Actions workflow unless you have a specific reason. Git Sync authentication stays in Grafana under **Administration > General > Provisioning**.